68 lines
2.7 KiB
Plaintext
68 lines
2.7 KiB
Plaintext
[PARSER]
|
|
Name apache
|
|
Format regex
|
|
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
|
Time_Key time
|
|
Time_Format %d/%b/%Y:%H:%M:%S %z
|
|
|
|
[PARSER]
|
|
Name apache2
|
|
Format regex
|
|
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
|
Time_Key time
|
|
Time_Format %d/%b/%Y:%H:%M:%S %z
|
|
|
|
[PARSER]
|
|
Name apache_error
|
|
Format regex
|
|
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
|
|
|
|
[PARSER]
|
|
Name nginx
|
|
Format regex
|
|
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
|
Time_Key time
|
|
Time_Format %d/%b/%Y:%H:%M:%S %z
|
|
|
|
[PARSER]
|
|
Name json
|
|
Format json
|
|
Time_Key time
|
|
Time_Format %d/%b/%Y:%H:%M:%S %z
|
|
|
|
[PARSER]
|
|
Name docker
|
|
Format json
|
|
Time_Key time
|
|
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
|
Time_Keep On
|
|
|
|
[PARSER]
|
|
# https://rubular.com/r/V3W1DWyv5uFCfh
|
|
Name nginx-ingress
|
|
Format regex
|
|
Regex ^(?<host>[^ ]*) - (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*) "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<request_length>[^ ]*) (?<request_time>[^ ]*) \[(?<proxy_upstream_name>[^ ]*)\] (\[(?<proxy_alternative_upstream_name>[^ ]*)\] )?(?<upstream_addr>[^ ]*) (?<upstream_response_length>[^ ]*) (?<upstream_response_time>[^ ]*) (?<upstream_status>[^ ]*) (?<reg_id>[^ ]*).*$
|
|
Time_Key time
|
|
Time_Format %d/%b/%Y:%H:%M:%S %z
|
|
|
|
[PARSER]
|
|
Name gitea
|
|
Format regex
|
|
Regex ^(?<time>[^ ]\d+\/\d+\/\d+ \d+:\d+:\d+) (((?<model_func>.*) \[I\])? \[[0-9a-z-]+\] (\[SQL\] (?<query>.*) - (?<query_time>[0-9.]+)µs|(?<message>.*))|\[[0-9a-z-]+\] router: (?<state>\w+) (?<method>\S+) (?<path>.*?) for (?<src>[^ ]*):(?<src_port>[^ ]*), (?<status_code>[^ ]*) (?<status_msg>[^ ]*) in (?<exec_time>[0-9.]+)ms @ (?<func>.*).*)
|
|
Time_Key time
|
|
Time_Format %Y/%m/%d %H:%M:%S
|
|
|
|
[PARSER]
|
|
Name cri
|
|
Format regex
|
|
# XXX: modified from upstream: s/message/log/
|
|
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
|
|
Time_Key time
|
|
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
|
|
|
[PARSER]
|
|
Name catchall
|
|
Format regex
|
|
Regex ^(?<message>.*)$
|
|
|
|
|